GCP - IAM, Principals & Org Unauthenticated Enum

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Iam & GCP Principals

Kwa maelezo zaidi angalia:

GCP - IAM, Principals & Org Policies Enum

Je, jina la kikoa linatumika katika Workspace?

1. Angalia rekodi za DNS

Ikiwa ina rekodi ya google-site-verification ni uwezekano kwamba inatumia (au ilikuwa inatumia) Workspace:

dig txt hacktricks.xyz

[...]
hacktricks.xyz.		3600	IN	TXT	"google-site-verification=2mWyPXMPXEEy6QqWbCfWkxFTcQhyYdwHrOxee1Yeo-0"
hacktricks.xyz.		3600	IN	TXT	"google-site-verification=C19PtLcZ1EGyzUYYJTX1Tp6bOGessxzN9gqE-SVKhRA"
hacktricks.xyz.		300	IN	TXT	"v=spf1 include:usb._netblocks.mimecast.com include:_spf.google.com include:_spf.psm.knowbe4.com include:_spf.salesforce.com include:spf.mandrillapp.com ~all"

Ikiwa kitu kama include:_spf.google.com pia kinaonekana, kinathibitisha hilo (kumbuka kwamba ikiwa hakionekani, haikatai kwani kikoa kinaweza kuwa katika Workspace bila kutumia gmail kama mtoa huduma wa barua).

1. Jaribu kuanzisha Workspace na kikoa hicho

Chaguo lingine ni kujaribu kuanzisha Workspace kwa kutumia kikoa, ikiwa inasema kwamba kikoa tayari kinatumika (kama katika picha), unajua tayari kinatumika!

Ili kujaribu kuanzisha kikoa cha Workspace fuata: https://workspace.google.com/business/signup/welcome

1. Jaribu kurejesha nenosiri la barua pepe kwa kutumia kikoa hicho

Ikiwa unajua anwani yoyote halali ya barua pepe inayotumika katika kikoa hicho (kama: [e-mail] au [e-mail]) unaweza kujaribu kurejesha akaunti katika https://accounts.google.com/signin/v2/recoveryidentifier, na ikiwa jaribio halionyeshi kosa linaloashiria kwamba Google haina wazo kuhusu akaunti hiyo, basi inatumia Workspace.

Tambua barua pepe na akaunti za huduma

Inawezekana kutambua barua pepe halali za kikoa cha Workspace na barua pepe za SA kwa kujaribu kuwapa ruhusa na kuangalia ujumbe wa makosa. Kwa hili unahitaji tu kuwa na ruhusa ya kutoa ruhusa kwa mradi (ambayo inaweza kuwa inamilikiwa tu na wewe).

Kumbuka kwamba ili kuziangalia lakini hata kama zipo usiwape ruhusa unaweza kutumia aina serviceAccount wakati ni user na user wakati ni SA:

# Try to assign permissions to user '[e-mail]'
# but indicating it's a service account
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
--member='serviceAccount:[e-mail]' \
--role='roles/viewer'
## Response:
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User [e-mail] does not exist.

# Now try with a valid email
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
--member='serviceAccount:[e-mail]' \
--role='roles/viewer'
# Response:
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal [e-mail] is of type "user". The principal should appear as "user:[e-mail]". See https://cloud.google.com/iam/help/members/types for additional documentation.

Njia ya haraka ya kuhesabu Akaunti za Huduma katika miradi inayojulikana ni kujaribu kufikia URL: https://iam.googleapis.com/v1/projects/<project-id>/serviceAccounts/<sa-email> Kwa mfano: https://iam.googleapis.com/v1/projects/gcp-labs-3uis1xlx/serviceAccounts/[e-mail]

Ikiwa jibu ni 403, inamaanisha kuwa SA ipo. Lakini ikiwa jibu ni 404 inamaanisha kuwa haipo:

// Exists
{
"error": {
"code": 403,
"message": "Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.",
"status": "PERMISSION_DENIED"
}
}

// Doesn't exist
{
"error": {
"code": 404,
"message": "Unknown service account",
"status": "NOT_FOUND"
}
}

Note jinsi wakati barua pepe ya mtumiaji ilikuwa halali ujumbe wa kosa ulionyesha kuwa aina hiyo si, hivyo tulifanikiwa kugundua kuwa barua pepe [e-mail] inapatikana bila kutoa haki zozote.

Unaweza kufanya vivyo hivyo na Akaunti za Huduma ukitumia aina user: badala ya serviceAccount::

# Non existent
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
--member='serviceAccount:<invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
--role='roles/viewer'
# Response
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User <invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com does not exist.

# Existent
gcloud projects add-iam-policy-binding <project-controlled-by-you> \
--member='serviceAccount:<sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \
--role='roles/viewer'
# Response
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal [e-mail] is of type "serviceAccount". The principal should appear as "serviceAccount:[e-mail]". See https://cloud.google.com/iam/help/members/types for additional documentation.

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.